Pix 501 to Pix 501 VPN, Cisco VPN Client 1

[shortomiga]

I have a problem will a basic VPN proposal.
We have a PIX501 in the main office and a PIX501 in a second office. We would like the two Pix units to establish a VPN to allow users to see the server in the main office. At the same time the users at both sites need to be able to access the internet while the VPN is connected. We also need the ability for users on Cisco VPN client software to access the server in the main office.

All sites have 2meg broadband

Is this possible with the hardware configuration explained above ?

 

[NetworkGhost]

Yes it is possible. Is that all you needed?

 

[shortomiga]

It's nice to hear that.

We have a consultancy company looking at this and they really are struggling, so I think we will end up doing it ourselves.

The pix in the main office is on a fixed IP, but the others are dynamic.
What is starting point with the pix config, do you have any example of the config for pix to pix vpn or should I post our current config which will only allow cisco vpn client in which also doesn't work properly, because if a second client connects then the first gets booted off.

 

[KiscoKid]

Cisco's webpage has lots of good info about setting up a VPN tunnel from scratch. Does the following help you at all:

http://www.cisco.com/en/US/products...figuration_guide_chapter09186a0080172795.html

 

[Triplejolt]

Here's a basic config which can be applied to both sites (asuming you're not using private addresses):
SITE1

access-list SITE1-to-SITE2 permit ip [IP address and mask from SITE1] [IP address and mask from SITE2]

This line forces all traffic originating from the inside of site1 with site2 as destination into the VPN tunnel.

sysopt connection permit-ipsec
crypto ipsec transform-set [b]ESP-3DES-MD5[/b] esp-3des esp-md5-hmac
crypto map SITE1 10 ipsec-isakmp 
crypto map SITE1 10 match address SITE1-to-SITE2 
crypto map SITE1 10 set peer [remote site outside address]
crypto map SITE1 10 set transform-set [b]ESP-3DES-MD5[/b]
crypto map SITE1 interface outside

isakmp enable outside 
isakmp key [pre-share key (just make something up)] address [remote site outside address] netmask 255.255.255.255
isakmp policy 10 authentication pre-share 
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2 
isakmp policy 10 lifetime 86400

This will set up and initiate the VPN tunnel at site1. Modify the config to fit on the PIX at Site2 and you should have it up and running. This config will only encrypt traffic between sites. All other traffic will pass on to the outside interface and through to the internet.

Hope this helps.

A firm beleiver of "Keep it Simple" philosophy
Cheers
/T

 

[shortomiga]

Thanks for the pointers,

I will pass these on to see if the consultancy can resolve our issues

Regards

S